# Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge

> The Chaos ransomware group (assessed with moderate confidence to be a BlackSuit/Royal rebrand or successor) is deploying a Rust/Tokio post-compromise implant called msaRAT that never opens a network connection of its own. Instead it drives a headless Chrome or Edge instance over the Chrome DevTools Protocol and relays all C2 traffic through a WebRTC data channel forced over Twilio's TURN infrastructure, so defenders see nothing but a legitimate-looking HeadlessChrome process calling Cloudflare Workers and Twilio.

- **Published:** 2026-07-23T00:00:00Z
- **Last reviewed:** 2026-07-25T22:06:17.620Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1663
- **ID:** TL-2026-1663
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Chaos
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Cisco Talos documented msaRAT, a previously unreported Rust-based implant written on the Tokio async runtime, discovered on a Windows host during a Chaos ransomware intrusion, deployed after initial access and RMM-based persistence but ahead of the Chaos ransomware encryptor. msaRAT is delivered via an MSI installer (`update_ms.msi`) staged from `https://172.86.126.18:443/update_ms.msi` using `curl.exe` and dropped to `C:\programdata\update_ms.msi`. The MSI impersonates a Windows Update package via forged property metadata and defines a custom action (`CA_Run_EA2AEBC3`) that fires after `InstallFinalize`, loading a DLL (`lib.dll`) embedded in the MSI's Binary table (`Bin_lib_EA2AEBC3`) directly into memory and invoking its exported `RUN` function -- the installer never writes the payload DLL to disk as a standalone file.

Once running, msaRAT enumerates environment variables (`ProgramFiles`, `PROGRAMFILES(X86)`, `LOCALAPPDATA`) and the registry App Paths key (`HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe`) to locate an installed Chrome or Edge binary, then launches it via `CreateProcessW` with `--headless`, `--disable-gpu`, `--user-data-dir` (a private profile directory, bypassing Chrome 136+ default-profile CDP restrictions announced in March 2025) and `--remote-debugging-port=9222`. msaRAT connects to the browser's local CDP WebSocket endpoint on `localhost:9222` and uses `Runtime.evaluate` to inject JavaScript, and `Runtime.addBinding` to register callback bindings (`msaOpen`, `msaClose`, `msaError`, `msaMessage`) that bridge the injected page context back to the Rust process. All traffic between the RAT process and the browser it controls is confined to loopback (127.0.0.1); the RAT process itself never opens a direct outbound socket.

The injected browser page establishes a WebRTC RTCPeerConnection and creates a DataChannel with a randomly generated 5-20 character alphanumeric label. SDP offer/answer signaling is exchanged out-of-band through a Cloudflare Worker acting as a relay/mailbox (`is-01-ast.ols-img-12.workers.dev`), and STUN discovery uses Google's public server (`stun2.l.google.com`). Critically, the implant deliberately omits host and server-reflexive ICE candidates, preventing any peer-to-peer path from being negotiated, which forces every connection through Twilio's TURN relay service (`global.turn.twilio.com`). The result: outbound network flows from the compromised host are TLS connections from a `HeadlessChrome`-identified process to Cloudflare and Twilio IP space -- infrastructure defenders routinely allowlist. Application-layer messages inside the DataChannel are further encrypted with ChaCha20-Poly1305, keyed via an ECDH handshake (an initial 0xFE-tagged handshake frame) layered underneath the DTLS transport encryption WebRTC already provides, giving double encryption end to end. Outbound HTTP requests forge Origin/Referer headers to impersonate Microsoft's official website.

Chaos itself emerged around February 2025 and is tracked by Talos with moderate confidence as either a rebrand of, or run by former members of, the BlackSuit (Royal) ransomware operation, based on encryption tooling, ransom-note structure, and TTP overlap; BlackSuit's infrastructure was seized in a DOJ-led international takedown on 2025-07-24. Chaos affiliates gain initial access primarily through email-bombing/vishing campaigns that direct victims to call a fake IT help desk, which then talks the victim into launching Microsoft Quick Assist to grant remote control (T1598.004 combined with abuse of a legitimate remote-assistance utility). Once in, operators install commodity RMM tools (AnyDesk, ScreenConnect, OptiTune, Syncro RMM, Splashtop) for durable access, move laterally via RDP, SMB/admin shares, WMI, and Impacket-based SSH/SMB tooling, and exfiltrate data using GoodSync renamed to masquerade as `wininit.exe`, staged to attacker-controlled cloud storage. The Chaos encryptor supports Windows, ESXi, Linux, and NAS targets, uses Curve25519 ECDH plus AES-256 with per-file keys, and offers a configurable partial/percentage encryption mode (observed default ~30%) for speed, appending the `.chaos` extension. Extortion has escalated from double (encrypt + leak) to triple (add DDoS threats against victim infrastructure) and elements of quadruple extortion (direct outreach to the victim's customers/competitors); one observed ransom demand was $300,000, with payment promising a decryptor, a pen-test report, and an assurance of data deletion.

msaRAT represents a novel, hard-to-detect C2 evasion pattern: it is not a browser exploit, it is abuse of legitimate, fully-patched browser automation (CDP) plus legitimate cloud relay infrastructure (Cloudflare Workers, Twilio TURN) to make ransomware C2 indistinguishable from ordinary browser telemetry. Talos assesses similar TURN-relay C2 concepts were previously demonstrated by Praetorian researchers (August 2025, conferencing-platform TURN infrastructure) and observed in the wild via a WebRTC-based web-skimmer documented by Sansec (March 2026), indicating the technique is proliferating beyond proof-of-concept.

## MITRE ATT&CK

- T1598 Phishing for Information
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1047 Windows Management Instrumentation
- T1106 Native API
- T1547 Boot or Logon Autostart Execution
- T1133 External Remote Services
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1620 Reflective Code Loading
- T1140 Deobfuscate/Decode Files or Information
- T1684.001 Impersonation
- T1555 Credentials from Password Stores
- T1016 System Network Configuration Discovery
- T1482 Domain Trust Discovery
- T1033 System Owner/User Discovery
- T1057 Process Discovery
- T1018 Remote System Discovery
- T1497 Virtualization/Sandbox Evasion
- T1135 Network Share Discovery
- T1021 Remote Services
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1219 Remote Access Tools
- T1105 Ingress Tool Transfer
- T1102 Web Service
- T1572 Protocol Tunneling
- T1090 Proxy
- T1567 Exfiltration Over Web Service
- T1041 Exfiltration Over C2 Channel
- T1490 Inhibit System Recovery
- T1486 Data Encrypted for Impact
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1608 Stage Capabilities
- T1566 Phishing
- T1204 User Execution
- T1218 System Binary Proxy Execution
- T1129 Shared Modules

## Sources

- [Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge](https://thehackernews.com/2026/07/chaos-ransomware-uses-msarat-to-route.html)
- [Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel](https://blog.talosintelligence.com/chaos-msarat-living-off-the-browser-to-build-covert-c2-channel/)
- [Unmasking the new Chaos RaaS group attacks](https://blog.talosintelligence.com/new-chaos-ransomware/)
- [New msaRAT malware uses Chrome, Edge browsers to route C2 traffic](https://www.bleepingcomputer.com/news/security/new-msarat-malware-uses-chrome-edge-browsers-to-route-c2-traffic/)
- [Chaos ransomware msaRAT hides its C2 channel inside a legitimate browser process](https://www.helpnetsecurity.com/2026/07/23/cisco-talos-chaos-ransomware-msarat/)
- [msaRAT Hides C2 Traffic Inside Chrome and Edge](https://blog.gridinsoft.com/msarat-chrome-edge-browser-c2/)
- [Chaos Ransomware: RaaS Resurgence & Detection](https://www.attackiq.com/2026/07/16/chaos-ransomware/)
- [Chaos Ransomware: BlackSuit-Linked RaaS Resurgence and Detection Opportunities](https://securityboulevard.com/2026/07/chaos-ransomware-blacksuit-linked-raas-resurgence-and-detection-opportunities/)
- [Cisco-Talos/IOCs: chaos-msarat.txt](https://github.com/Cisco-Talos/IOCs/blob/main/2026/07/chaos-msarat.txt)
- [Chaos ransomware group profile](https://www.ransomlook.io/group/chaos)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1663